− Sample Configuration Using the ip nat outside source static
Cisco − Sample Configuration Using the ip nat outside source static Command
Table of Contents
Sample Configuration Using the ip nat outside source static Command......................................................1
Introduction.............................................................................................................................................1
Before You Begin...................................................................................................................................1
Conventions......................................................................................................................................1
Prerequisites.....................................................................................................................................1
Components Used.............................................................................................................................1
Configure................................................................................................................................................1
Network Diagram.............................................................................................................................1
Configurations..................................................................................................................................2
Verify......................................................................................................................................................3
Troubleshoot...........................................................................................................................................3
Summary.................................................................................................................................................4
Related Information................................................................................................................................5
i
Sample Configuration Using the ip nat outside
source static Command
Introduction
Before You Begin
Conventions
Prerequisites
Components Used
Configure
Network Diagram
Configurations
Verify
Troubleshoot
Summary
Related Information
Introduction
This document provides a sample configuration using the ip nat outside source static command, including a
brief description of what happens to the IP packet during the NAT process. Consider the following network
topology as an example.
Before You Begin
Conventions
For more information on document conventions, see the Cisco Technical Tips Conventions.
Prerequisites
There are no specific prerequisites for this document.
Components Used
This document is not restricted to specific software and hardware versions.
Configure
In this section, you are presented with the information to configure the features described in this document.
Note: To find additional information on the commands used in this document, use the Command Lookup
Tool ( registered customers only) .
Network Diagram
This document uses the network setup shown in the diagram below.
Cisco − Sample Configuration Using the ip nat outside source static Command
When you issue a ping sourced from Router 2514w's Loopback1 interface destined to Router 2501e's
Loopback0 interface, the following happens:
On the outside interface of Router 2514x, the ping packet shows up with a Source Address (SA) of
172.16.89.32 and a Destination Address (DA) of 171.68.1.1. NAT translates the SA to the inside global
address 171.68.16.5 (according to the ip nat outside source static command configured on Router 2514x).
Router 2514x then checks its routing table for a route to 171.68.1.1. If the route does not exist, Router 2514x
drops the packet. In this case, Router 2514x has a route to 171.68.1.1 through the static route to 171.68.1.0, so
it forwards the packet to the destination. Router 2501e sees the packet on its incoming interface with an SA of
171.68.16.5, and a DA of 171.68.1.1. It responds by sending an Internet Control Message Protocol (ICMP)
echo reply to 171.68.16.5. If it does not have a route, it drops the packet. However, in this case, it has the
(default) route, so it sends a reply packet to Router 2514x, using a SA of 171.68.1.1, and a DA of 171.68.16.5.
Router 2514x sees the packet and checks for a route to the 171.68.16.5 address. If it does not have one, it
responds with an ICMP unreachable reply. In this case, it has a route to 171.68.16.5 (due to the static route),
so it translates the packet back to the 172.16.89.32 address, and forwards it out its outside interface.
Configurations
Router 2514w
hostname rp−2514w
!
interface Loopback1
ip address 172.16.89.32 255.255.255.0
!
interface Ethernet1
no ip address
no ip mroute−cache
!
interface Serial0
ip address 172.16.191.254 255.255.255.252
no ip mroute−cache
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.191.253
Router 2514x
Cisco − Sample Configuration Using the ip nat outside source static Command
hostname rp−2514X
!
ip nat outside source static 172.16.89.32 171.68.16.5
!
interface Ethernet1
ip address 171.68.192.202 255.255.255.0
ip nat inside
no ip mroute−cache
no ip route−cache
!
interface Serial1
ip address 172.16.191.253 255.255.255.252
no ip route−cache
ip nat outside
clockrate 2000000
!
ip classless
ip route 172.16.89.0 255.255.255.0 172.16.191.254
ip route 171.68.1.0 255.255.255.0 171.68.192.201
ip route 171.68.16.0 255.255.255.0 172.16.191.254
Router 2501e
hostname rp−2501E
!
interface Loopback0
ip address 171.68.1.1 255.255.255.0
!
interface Ethernet0
ip address 171.68.192.201 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 171.68.192.202
Verify
There is currently no verification procedure available for this configuration.
Troubleshoot
This example used the NAT translation debugging and IP packet debugging to demonstrate the NAT process.
Note: Because the debug commands generate a significant amount of output, use them only when traffic on
the IP network is low, so other activity on the system is not adversely affected.
The following output shows the first packet arriving on the outside interface of Router 2514X. The source
address of 172.16.89.32 gets translated to 171.68.16.5. The ICMP packet is forwarded toward the destination
out the Ethernet1 interface.
1d00h: NAT*: s=172.16.89.32−>171.68.16.5, d=171.68.1.1 [15]
1d00h: IP: s=171.68.16.5 (Serial1), d=171.68.1.1 (Ethernet1), g=171.68.192.201,
len 100, forward
1d00h: ICMP type=8, code=0
The following output shows the return packet sourced from 171.68.1.1 with a destination address of
Cisco − Sample Configuration Using the ip nat outside source static Command
171.68.16.5, which gets translated to 172.16.89.32. The resulting ICMP packet gets forwarded out the Serial1
interface.
1d00h: NAT: s=171.68.1.1, d=171.68.16.5−>172.16.89.32 [15]
1d00h: IP: s=171.68.1.1 (Ethernet1), d=172.16.89.32 (Serial1), g=172.16.191.254,
len 100, forward
1d00h: ICMP type=0, code=0
The exchange of ICMP packets continues. The NAT process for the following debug output is the same as
that described above.
1d00h: NAT*: s=172.16.89.32−>171.68.16.5, d=171.68.1.1 [16]
1d00h: IP: s=171.68.16.5 (Serial1), d=171.68.1.1 (Ethernet1), g=171.68.192.201,
len 100, forward
1d00h: ICMP type=8, code=0
1d00h: NAT: s=171.68.1.1, d=171.68.16.5−>172.16.89.32 [16]
1d00h: IP: s=171.68.1.1 (Ethernet1), d=172.16.89.32 (Serial1), g=172.16.191.254,
len 100, forward
1d00h: ICMP type=0, code=0
1d00h: NAT*: s=172.16.89.32−>171.68.16.5, d=171.68.1.1 [17]
1d00h: IP: s=171.68.16.5 (Serial1), d=171.68.1.1 (Ethernet1), g=171.68.192.201,
len 100, forward
1d00h: ICMP type=8, code=0
1d00h: NAT: s=171.68.1.1, d=171.68.16.5−>172.16.89.32 [17]
1d00h: IP: s=171.68.1.1 (Ethernet1), d=172.16.89.32 (Serial1), g=172.16.191.254,
len 100, forward
1d00h: ICMP type=0, code=0
1d00h: NAT*: s=172.16.89.32−>171.68.16.5, d=171.68.1.1 [18]
1d00h: IP: s=171.68.16.5 (Serial1), d=171.68.1.1 (Ethernet1), g=171.68.192.201,
len 100, forward
1d00h: ICMP type=8, code=0
1d00h: NAT: s=171.68.1.1, d=171.68.16.5−>172.16.89.32 [18]
1d00h: IP: s=171.68.1.1 (Ethernet1), d=172.16.89.32 (Serial1), g=172.16.191.254,
len 100, forward
1d00h: ICMP type=0, code=0
1d00h: NAT*: s=172.16.89.32−>171.68.16.5, d=171.68.1.1 [19]
1d00h: IP: s=171.68.16.5 (Serial1), d=171.68.1.1 (Ethernet1), g=171.68.192.201,
len 100, forward
1d00h: ICMP type=8, code=0
1d00h: NAT: s=171.68.1.1, d=171.68.16.5−>172.16.89.32 [19]
1d00h: IP: s=171.68.1.1 (Ethernet1), d=172.16.89.32 (Serial1), g=172.16.191.254,
len 100, forward
1d00h: ICMP type=0, code=0
Summary
There are two important things to note in this example.
First, when the packet travels from outside to inside, translation occurs first, and then the routing table is
checked for the destination. When the packet travels from inside to outside, the routing table is checked for
the destination first, and then translation occurs. For more information refer to NAT Order of Operation.
Cisco − Sample Configuration Using the ip nat outside source static Command
Secondly, it is important to note which part of the IP packet gets translated when using each of the commands
above. The following table contains a guideline:
Command
ip nat outside source
static
ip nat inside source static
Action
• translates the source of the IP packets
that are traveling outside to inside
• translates the destination of the IP
packets that are traveling inside to
outside
• translates the source of IP packets that
are traveling inside to outside
• translates the destination of the IP
packets that are traveling outside to
inside
What the above guidelines indicate is that there is more than one way to translate a packet. Depending on your
specific needs, you should determine how to define the NAT interfaces (inside or outside) and what routes the
routing table should contain before or after translation. Keep in mind that the portion of the packet that will be
translated depends upon the direction the packet is traveling, and how you configured NAT.
Related Information
• Sample Configuration Using the ip nat outside source list Command
• Configuring Network Address Translation: Getting Started
• NAT Support Page
• Technical Support − Cisco Systems
All contents are Copyright © 1992−2003 Cisco Systems, Inc. All rights reserved. Important Notices and Privacy Statement.
Cisco − Sample Configuration Using the ip nat outside source static Command